Error in SQL syntax

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'desc, ffname) VALUES ('Test', 'Spam all you wont !', 'Test')' at line 1

<?
include_once("../inc/func.php");
include_once("../inc/db.php");
$page = "New Category";
$sql="SELECT * FROM forum_categorys ORDER BY id DESC";
// ORDER BY id DESC is order result by descending
$result=mysql_query($sql);
if(isset($_POST['Submit'])){
// get data that sent from form
$descc=$_POST['des'];
$categorys=$_POST['catname'];



$sql="INSERT INTO forum_categorys(catname, desc, ffname)
VALUES
('$categorys', '$descc', '$categorys')";
$result=mysql_query($sql) or die(mysql_error());


if($result){
$msg = "You created the category $categorys";
}
else {
$msg = "<td class='warning'>ERROR</td>";
}}

?>

<table width="90%" border="0" align="center" cellpadding="3" cellspacing="2" class="menutable">
  <tr>
<?
require_once("../menu.php");
?>

  </tr>
</table>
<table width="90%" border="0" align="center" cellpadding="0" cellspacing="0">
  <tr>
<? echo "$msg"; ?>
  </tr>
</table>
<?php 
if(isloggedin() && $mysql->userlevel == "2"){
	?>
<table width="90%" border="0" align="center" cellpadding="0" cellspacing="1" class="maintable">
<tr>
<form id="form1" name="form1" method="post" action="new_category.php">
<td class="row">
<table width="100%" border="0" cellpadding="3" cellspacing="1">
<tr>
<td colspan="3" class="row"><strong>Create New Category</strong></td>
</tr>
<tr>
<td width="19%" class="row"><strong>Category name</strong></td>
<td width="79%" class="row"><input name="catname" type="text" id="catname" size="50" /></td>
</tr>
<tr>
<td width="19%" class="row"><strong>Category Description</strong></td>
<td width="79%" class="row"><input name="des" type="text" id="des" size="50" /></td>
</tr>
<tr>
<tr>
<td class="row">&nbsp;</td>
<td class="row"><input type="submit" name="Submit" value="Submit" /></td>
<td width="2%" class="row">&nbsp;</td>
</tr>
</table>
</td>
</form>
</tr>
</table>
<?php
}
else {};
?>
<?php footer(); ?>

Code (markup):

Anyone have any idea what is wrong ?

 

Try this...

$sql = "INSERT INTO `forum_categorys` (`catname`, `desc`, `ffname`) VALUES ($categorys, '$descc', '$categorys')";
$result=mysql_query($sql) or die(mysql_error());

Code (markup):

 

www.php.net/mysql_real_escape_string

Please!

 

LOL ^^^

You have to start somewhere tho..